NIST finalizes initial set of smart grid cyber security guidelines

September 15, 2010

The National Institute of Standards and Technology has issued its first Guidelines for Smart Grid Cyber Security, which includes high-level security requirements, a framework for assessing risks, an evaluation of privacy issues at personal residences, and additional information for businesses and organizations to use as they craft strategies to protect the modernizing power grid from attacks, malicious code, cascading errors and other threats.

The product of two formal public reviews and the focus of numerous workshops and teleconferences over the past 17 months, the three-volume set of guidelines is intended to facilitate organization-specific Smart Grid cyber security strategies focused on prevention, detection, response and recovery.

The new report was prepared by the Cyber Security Working Group (CSWG) of the Smart Grid Interoperability Panel, a public-private partnership launched by NIST with American Recovery and Reinvestment Act funding from the Department of Energy. The guidelines are the second major output of NIST-coordinated efforts to identify and develop standards needed to convert the nation's aging electric grid into an advanced, digital infrastructure with two-way capabilities for communicating information, controlling equipment and distributing energy.

"These advisory guidelines are a starting point for the sustained national effort that will be required to build a safe, secure and reliable Smart Grid," said George Arnold, NIST's national coordinator for Smart Grid interoperability. "They provide a technical foundation for utilities, hardware and software manufacturers, energy management service providers, and others to build upon. Each organization's implementation of cyber security requirements should evolve as technology advances and new threats to grid security arise."

The report advocates a layered—or "defense in depth"—approach to security. Because cyber security threats are diverse and evolving, the report recommends implementing multiple levels of security.

The guidelines identify 137 interfaces—points of data exchange or other types of interactions within or between different Smart Grid systems and subsystems. These are assigned to one or more of 22 categories on the basis of shared or similar functional and security characteristics. In all, the report details 189 high-level security requirements applicable either to the entire Smart Grid or to particular parts of the grid and associated interface categories.

Under the Energy Independence and Security Act of 2007, Congress assigned NIST to coordinate development of a framework that would enable a Smart Grid that is safe, secure and interoperable from end to end. In its January 2010 report, NIST described a high-level conceptual reference model for the Smart Grid, identified existing or emerging standards relevant to the ongoing development of an interoperable Smart Grid, and spelled out several high-priority standards-related gaps and issues that NIST and its partners are now addressing.

Related Stories

By connecting hundreds or even thousands of computers together to work on a single project, computer scientists are more frequently using a technique called grid computing to do previously intractable computations.

In recent years cell phones and PDAs—"Personal Digital Assistants"—have exploded in power, performance and features. They now often boast expanded memory, cameras, Global Positioning System receivers and the ability to ...

America's power grid today resembles the country's canal system of the 19th Century. A marvel of engineering for its time, the canal system eventually could not keep pace with the growing demands of transcontinental transportation.

Electricity is all around us. It lifts elevators, pumps gas, lights rooms, cooks food, and even powers a growing fleet of cars. We generally take the vast electric grid for granted until it turns off. Only then do we realize ...

Recommended for you

It sounds like a science-fiction nightmare. But "killer robots" have the likes of British scientist Stephen Hawking and Apple co-founder Steve Wozniak fretting, and warning they could fuel ethnic cleansing and an arms race.

A startup team calls their work a product. They also call it a social movement. Many people in the over-7,000 islands in the Philippines lack access to electricity .The startup would like to make a difference. Their main ...

Are some people fed up with remembering and using passwords and PINs to make it though the day? Those who have had enough would prefer to do without them. For mobile tasks that involve banking, though, it is obvious that ...